OpenWRT on Mikrotik Routerboard 411/750

Introduction

The Mikrotik Routerboards are cheap and versatile embedded platforms that can be used for routers, WiFi APs and the like. In a rather wide range of products, I happen to have access to the RB411 and the RB750 two devices of very different properties. While the RB750 is effectively a 5 port 10/100 Mbit Ethernet switch with an Atheros AR71xx CPU on it, the RB411 has the same CPU with one Ethernet port and a Mini PCI slot as well as a serial port (and a beeper ;)). Because of their price (around 40 €), both are very interesting targets to do some experiments with them. Unfortunately, they come with Mikrotiks RouterOS which seems to be a modified Linux that officially cannot be modified. Interestingly, the RB do not ship with a GPL and as far as I have heard, Mikrotik does not publish the source code as required by the GPL. So, who wants RouterOS anyway? 😉

Although I do not have other Mikrotik products, I assume that the OpenWRT flash procedure is similar for products using RouterBOOT as bootloader and the Atheros AR71xx CPU. However, this guide comes without warranty, everything you do is at your full risk. Although I was unable to do so, there is a certain risk of permanently bricking your device.

The process of flashing the Routerboard has 5 major steps:

Prepare an OpenWRT Ramdisk Image

Prepare the OpenWRT target Image

Configure the TFTP and DHCP Server

Boot the Routerboard using the Ramdisk Image

Flash the Target Image

Preparation Procedure

Prepare an OpenWRT Ramdisk Image

Compiling OpenWRT from the SVN is actually more straight forward than you might imagine. Take your favorite Linux Distribution (Ubuntu in my case), check our the SVN, configure it and hit make. There you go.

Get the source code
Check out the latest and greatest version of OpenWRT:

svn co svn://svn.openwrt.org/openwrt/trunk/

I have used revision 27019.

Configure OpenWRT according to your needs

cd trunk
make menuconfig

While you are of course free to select all the packages you need and deselect those you do not need, you have to set the following options to make it work in the Routerboards:

Configure the TFTP and DHCP Server

Configure your network Interface
The network interface to which the Routerboard is connected must have a unique IP with a DHCP running on it. To make debugging easier, it is usually a good idea to directly connect the Routerboard to your NIC without other devices involved.
Configure the Interface within the subnet 192.168.1.0/24 (OpenWRTs default subnet) but try to avoid 192.168.1.1 (OpenWRTs default IP). I have used 192.168.1.2.

Install DHCP and TFTP Servers
You will need a DHCP Server to assign an IP address to the Routerboard for the flash process. Also, the DHCP server tells the board which file to use as image. Frankly, the tftp Server is responsible to provide the image file to the RB.
On Ubuntu Linux, I have used these packages:

apt-get install dhcp3-server atftpd

Configure the DHCP Server
The DHCP Server does not need much configuration. I use the following as /etc/dhcp3/dhcpd.conf:

You may want to modify the IP range to match your subnet, the hardware ethernet MAC address of your router board, the next-server address of your tftp server and the filename of the ramdisk image that should be booted over the network.

You can see, that the tftp server will look for image files in /tftpboot. Either change this directory or copy the OpenWRT ramdisk image (openwrt-ar71xx-nand-vmlinux-initramfs.elf) to /tftpboot.

cp bin/ar71xx/openwrt-ar71xx-nand-vmlinux-initramfs.elf /tftpboot

Apply the changed configuration

/etc/init.d/dhcp3-server reload
/etc/init.d/atftpd reload

Flash process for Routerboard 750

Booting the Ramdisk Image

The purpose of this step is to have a ramdisk version of OpenWRT running on the routerboard. This is a good basis for our flashing process and can also be used to test images without flashing them. This involves the following steps:

Connecting the Routerboard
Connect port 1 of the Routerboard with the Ethernet port that your DHCP and TFTP server listens on.

Boot the Routerboard
Now press and hold the “RES” button of the router board and connect power. Both LEDs (PWR and ACT) will be constantly on, keep pressing the button. After some seconds the “ACT” LED starts flashing, keep pressing. After some more seconds, the “ACT” LED turns off, now you can stop pressing the button. The board will now try to obtain an IP address via DHCP/BOOTP and then download and boot the Ramdisk image. You can see this activity by looking at the appropriate log files:

Create new file systems
After erasing the content of the flash, we now need to create new yaffs2 partitions. In principle, we could also make the rootfs ext2/3/4, but I have not tried this. The kernel partition has to be yaffs2 as far as I know to be compatible with the bootloader.

Copy the images onto the Routerboard
Copying the images onto the routerboard can be done in multiple ways, I have used secure file copy (scp). First, we have to create a password for the root user. On the routerboard, execute

passwd

and set a password. On the linux PC, you can now copy the images onto the Routerboard:

After some while, you should be able to ping the board at 192.168.1.1.

What if the Routerboard does not boot?

Do not panic. If the board is not reachable at 192.168.1.1 after some minutes, something must have gone wrong. You can always recover the boards using Mikrotiks Netinstall. Also, you can start again at the point where the ramdisk image should have booted. Unfortunately, the RB750 does not have a serial port, debugging problems with the linux boot process is probably *very* annoying.

Flash process for Routerboard 411

The flash process for the Routerboard 411 is almost similar to the process for the RB750 – only the flash layout is a bit different and hence the number of the target partitions have to be changed. Apart from that, you can use the exact same procedure. However, since the RB411 offers a serial port, debugging is much more convenient.

Booting the Ramdisk Image

The purpose of this step is to have a ramdisk version of OpenWRT running on the routerboard. This is a good basis for our flashing process and can also be used to test images without flashing them. This involves the following steps:

Connecting the Routerboard
Connect the Ethernet port of the Routerboard with the Ethernet port that your DHCP and TFTP server listens on.

Configure the Bootloader
Connect a serial cable to the serial port of the routerboard using the settings 115200 8n1. The boot process should look similar to this:

Create new file systems
After erasing the content of the flash, we now need to create new yaffs2 partitions. In principle, we could also make the rootfs ext2/3/4, but I have not tried this. The kernel partition has to be yaffs2 as far as I know to be compatible with the bootloader.

Copy the images onto the Routerboard
Copying the images onto the routerboard can be done in multiple ways, I have used secure file copy (scp). First, we have to create a password for the root user. On the routerboard, execute

passwd

and set a password. On the linux PC, you can now copy the images onto the Routerboard:

Just successfully flashed my RB411. THANK YOU !
PS: if you have more then 1 cpu or core, you can speed up building the firmware with ‘make’ option ‘-j’. Use number of your cores + 1, e.g. “make -j 3” for dual core systems, or “make -j 5” for quadcore..

I do not have a 750GL at my disposal, so I can only speculate. However, based on the specs of the RB 750GL and the commits in the OpenWRT repositories, I think that there is a pretty good chance. I assume that the bootloader works much the same way, so the procedure for the RB 750 should apply to the RB 750GL.
However, as said, this is pure speculation and has not been tested by me. If however you are successful in flashing your RB 750GL, please tell me!

Hey Bastian, I have a 750GL in hand and have been able to telnet into it, but NONE of the commands you list work. They all resulte in “bad command name”. The unit is running Mikrotik 5.2 – it appears to have a totally different shell…

Thanks for that guide! I noticed two things:
* After booting from tftp I have to plug the network cable into the second port to be able to reach the RB750.
* The kernel images I get are too big to be saved on the kernel partition. Is there any known way to strip them down?

Thanks for the article, i succesfully flashed my 411, but i’ve met some difficults. Maybe just missed something obvious hah, but still. It just says that kernel was not found during boot process, while it lays at /kernel and executable.

As far as I know, RouterBOOT will only boot the kernel from the first 4MB of the NAND. Increasing the partition size should be possible using the ram disk image but the RB will probably not boot afterwards. I have to confess through, that I did not try this myself.

Using more kernel functionality should be possible anyway by building some options as kernel modules and loading them at runtime. Have you tried this?

thank you for the information on how to connect to the RB750, that was new and useful infroamtion to me.

On actually loading a new firmware onto the router you can make yourself your life A LOT easier by using the wget2nand utility. All of steps 3 – 6 for the rb750 and 4-7 for the rb411 (and other mikrotik routers) are handled by that tool. All you have to do is host the two files, openwrt-ar71xx-nand-rootfs.tar.gz and openwrt-ar71xx-nand-vmlinux.elf in one directory on a webserver, and type
wget2nand http://www.yourdomain.com/upload-directory
and the tool will do ALL of the above tasks. Once finished, all you have to do is reboot the router (and switch to nand boot on device with serial access like the rb411 or rb450x devices like in step 8 above). Done

Hi! I applied this guide to a routerboard omnitik U-5HnD, I got the following lines. I can ping 192.168.1.1 but telnet 192.168.1.1 command advertise me: “Unable to connect to remote host: Connection timed out”.
Why?

I have not tried this – however, most bootloaders are opening telnet ports for a short amount of time. RouterBOOT on the routerBoards waits 2 seconds before booting. It is very well possible, that you can access the prompt via telnet during this period. However, I do not know if and on which port RouterBOOT is reachable.

I have not done this but I assume that you have to reconfigure the switch that is contained in the RB750GL to make each port a separate VLAN. Then you can create a separate eth0 interface for each VLAN.

Hi man, can you help me? i followed your steps and all goes good until the time i need to save the new kernel into router, after telnet into the new system, scp the files into tmp folder.

then when i go save it refuses and info me low space, i saw that 411 is a little bit diference of 750 at this point (the mtdblock is diferent), maybe in my case (rb951) is diferent too, but i dont know how to do, can you help me?

If the flash layout of your router differs, please be very careful and do not overwrite the flash without knowing what you are doing. If your device is still booting, please log into it via ssh/telnet and execute “cat /proc/mtd” to figure out the flash layout. Post it here and I may be able to help you.